Test credential limit through the public API

[adamtheturtle]

The credential-limit test mutated the private _MAX_CLIENT_CREDENTIALS module constant to make the store immediately full. That required importing a private module through the package and disabling Pyright private-use checking for the entire test file.

Exercise the documented limit honestly instead: create 100 credentials through the HTTP API, assert that every creation succeeds, and then verify that the 101st request is rejected. The mock-only loop takes well under a second, so no test-only production seam is needed.

This removes the private import, monkeypatch.setattr, and the file-wide Pyright suppression.

Validation:

• all configured pre-commit hooks
• all configured pre-push hooks (Mypy, Pyright, Pyrefly, Ty, verifytypes, docs, manifest and partition checks)
• focused credential-limit test: 1 passed
• full credential-free suite: 1,947 passed; 849 real-Vuforia cases skipped, including 6 Docker integration tests passed
• changed _model_target_web_api.py coverage: 100%

The combined local report remains the repository's known 99% without the separately partitioned real Vuforia backend; hosted CI combines the configured partitions and is the authoritative 100% gate.